逆向工程疑问
8048563: e8 0d 00 00 00 call 8048575 <exit@plt+0x141>
我试图对二进制文件进行逆向工程以获取乐趣，我在 objdump 输出中看到了这个调用。看着这一行，我认为调用将是动态链接的退出函数。但是，8048575 似乎是该程序的 .text 部分中的地址！
- 为什么会出现这种错误的函数命名？
- 呼叫落地的地方有以下行；为什么函数序言缺失？
8048575: 83 ec 6c sub esp,0x6c
8048563: e8 0d 00 00 00 call 8048575 <exit@plt+0x141>
I was trying to reverse engineer a binary for fun and I saw this call in the objdump output. Looking at this line, I thought the call would be to the exit function which was dynamically linked. However, 8048575 seems to be an address in the .text section of this program!
- Why does this wrong naming of function happen?
- The place where the call lands has the following line; why is the function prologue missing?
8048575: 83 ec 6c sub esp,0x6c
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
当程序调用共享库中的函数时，它会调用过程链接表 (PLT) 中的地址。最初，PLT 包含对动态链接器的调用，动态链接器将动态查找函数地址，然后用找到的地址替换 PLT 中的地址。
When a program calls a function in a shared library it calls an address in the Procedure Linkage Table (PLT). Initially the PLT contains a call into the dynamic linker, which will look up the function address dynamically and then replace the address in the PLT with the address that it found.
这是对 IAT（导入地址表）条目的调用，以便它可以对名为“exit”的函数执行模块间调用（实际上是跳转），这可以避免远调用并使动态链接更简单。至于序言“缺失”，根本不需要设置堆栈帧，事实上，对于大多数函数来说，它完全不需要，因此堆栈分配是序言，是唯一真正需要的函数堆栈帧是不受信任的“裸”汇编函数或对堆栈进行不可预测的更改的函数。
Thats a call to the IAT(import address table) entry so that it can perform an intermodular call(really a jump) to a function called 'exit`, this allow the avoidance of far calls and makes dynamic linkage simpler. As for the prologue being 'missing', setting up of a stack frame is not required at all, infact its totally unneeded for most functions, thus the stack allocation is the prologue, the only functions that really need stack frames are untrusted 'naked' assembly functions or those that do unpredictable changes to the stack.
分配堆栈空间是函数序言，不是吗？你怎么知道这不是
exit函数的开始？ .text 完全没问题，因为那是代码所在的地方。 （plt 只是指“程序列表”。）Allocating stack space is the function prologue, no? How do you know that's not the beginning of the
exitfunction? .text is totally fine since that is where code lives. (plt just refers to "program list table".)这实际上不是 IAT/PLT 调用，而是对同一文件中另一个函数的调用。该文件可能已删除其内部符号，并且 objdump 将所有地址显示为地址 + 偏移量之前的最后一个定义的符号。如果没有内部符号，这将命中最后一个 plt 链接函数，因为 plt 部分位于文本之前。
因此，显示的名称只是伪造的，可以忽略。
That's not actually a IAT/PLT call, it's a call to another function in the same file. The file probably has had its internal symbol stripped, and objdump displays all addresses as the last defined symbol before the address + an offset. With no internal symbols, this will hit the last plt-linked function, since the plt section comes before text.
So, the displayed name is just bogus and can be ignored.